Termite Attacks: Gnawing on Logs to Extract Secret Information

System audit logs aim to record information about system events that are triggered during any incident. Hence they inevitably contain sensitive information that needs to be kept secret. In particular, researchers have overlooked implicit secret content: content that is seemingly not secret but indirectly leaks secret information. We introduce Termite attacks, a new class of side channel attack that exploits such implicit content to learn secret information. Our work explores Termite attacks through three diverse cases showing how, under reasonable disclosure conditions, logs can be exploited by indirect inferences that produce significant side channels. We demonstrate how logs can be used to create both membership inference attacks and keystroke timing attacks, and show practical exploits against a common setup: a LEMP webserver with SSH daemon that is audited by the Linux Audit System. Then we demonstrate how to launch a concurrencybased timing side channel attack. Contrary to the belief that log information is too coarse-grained to be exploited against modern microarchitectural side channel attacks, we demonstrate how adversaries can craft timing side channels that are as fine as 100s of nanoseconds through system audit logs. Our proof-of-concept NetSpectre attack shows that adversary can steal a secret bit in 470 seconds with 81.25 % success rate with 12 memory loads.